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Abstract 

Blind quantum computation is a secure delegated quantum computing protocol where Alice who 
^ ■ does not have sufficient quantum technology at her disposal delegates her computation to Bob who 

has a fully-fledged quantum computer in such a way that Bob cannot learn anything about Alice's 
input, output, and algorithm. Protocols of blind quantum computation have been proposed for 
several qubit measurement-based computation models, such as the graph state model, the Affleck- 
Kennedy-Lieb-Tasaki model, and the Raussendorf-Harrington-Goyal topological model. Here, we 
consider blind quantum computation for the continuous-variable measurement-based model. We 
show that blind quantum computation is possible for the infinite squeezing case. We also show that 
the finite squeezing causes no additional problem in the blind setup apart from the one inherent 
to the continuous-variable measurement-based quantum computation. 
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I. INTRODUCTION 



When scalable quantum computers are realized, they will be used in "cloud computing 
style" since only limited number of people will be able to possess quantum computers. Blind 



quantum computation 



lOj] provides a solution to the issue of the client's security in such 



a cloud quantum computation. Blind quantum computation is a new secure protocol which 
enables Alice who does not have enough quantum technology to delegate her computation 
to Bob who has a fully-hedged quantum computer in such a way that Bob cannot learn 
anything about Alice's input, output, and algorithm. A protocol of the unconditionally 
secure universal blind quantum computation for almost classical Alice was hrst proposed 
in Ref. Ejby using the measurement-based quantum computation (MBQC) on the cluster 



state 



11- 



131 ] . and 



Tasaki state 



14 



ater generalized to other resource states such as the Affleck-Kennedy-Lieb- 



16 



15[ and the three-dimensional Raussendorf-Harrington-Goyal state 
20l which enables the topological protection 18, 9|. A subroutine which eases Alice's burden 

n n 

was invented [6jj. Also, a verification scheme which tests Bob's honesty was proposed [9J. The 



proof-of-principle experiment of the original protocol 



3| was realized in an optical system 



In this paper, we consider the continuous-variable (CV) version of the blind quantum 



computation. The CV cluster MBQC was proposed in Refs. 

1 



21 



22|. There, 



1+) 



V2 



(|0} + |1» 



state of a single qubit is replaced with the zero momentum state |0) p of a single mode 
(qumode), and the two-mode gate e %q ® q plays the role of the qubit Controlled-Z gate, 



Experiment a 
achieved 23 



|0)(0| ® I+\1){1\®Z. 



demonstrations of building blocks of the CV cluster MBQC were already 



27]. 



We show that blind quantum computation is possible in the infinite squeezing case. We 
also consider the finite squeezing case, and show that the finite squeezing causes no problem 
apart from the additional errors which come from the redundancy of gates required for the 
blindness. Since these errors are those even the non-blind CV MBQC has to cope with for 
its scalability, we conclude that the finite squeezing does not cause any fundamental problem 
in principle. 



2 



This paper is organized as follows. In the next section we will briefly review the CV 
cluster MBQC. We also review the qubit blind quantum computation in Sec. IIHI Then we 
explain our protocol in Sec. [TV] and show its correctness (Sec. |V} and blindness (Sec. |VT|) . 
Discussions are given in Sec. IVHI 



II. CV CLUSTER MBQC 



with s6l, where 



Let us briefly review the CV cluster MBQC proposed in Refs. 2l|, |22[. Let q and p be 
the quadrature "position" and "momentum" operators, respectively, satisfying the canonical 
commutation relation 

[q,p] = %. 

We also define the Weyl-Heisenberg operators 

X(s) = exp[— isp], 
Z(s) = exp[isq\, 

X(s)\t) q = \t + s) q , 
Z(s)\t) p = \t + s) p . 

Here, \t) q and \t) p are eigenvectors of q and p with the eigenvalue t, respectively. They 
satisfy 

X(s)Z(t) = e- ist Z(t)X(s), 
qX(s)=X(s)(q + s), 
pZ(s) = Z(s)(p + s). 

These Weyl-Heisenberg operators are CV analog of the qubit Pauli operators. The Fourier 
transform operator F is defined by 



F = exp 



i{q 2 +p 2 ) 



with 



F\s) g = \s) p . 
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This operator is the CV analog of the qubit Hadamard operator. However, special cares are 
needed because F is not Hermitian and 



F 2 \s) q = 


1 - s) q , 


F 2 \s) P = 


1 - s) 


F 4 = 


I- 


F^qF = 


-p, 


F ] pF = 


Q, 


Z(m)F = 


FX(m), 


X(m)F = 


FZ(-m 



The CV version of the Controlled- Z gate are defined by 

CZ = exp(iq <g) q). 

Note that we use the symbol CZ for both qubit CZ and CV CZ. But no confusion will occur 
because they can be distinguished from the context. The CV version of the Controlled-X 
gate is defined by 

CX = exp(—iq Cg> p). 

The elementary block of the CV cluster MBQC is the teleportation gate given in Fig. [TJ 
Here, 

and / is a polynomial of q. Note that and are obtained from FDjj, since 

(FD° q ) 3 FDf = D{, 
(FD° q f(FDL q )(FD° q ) = D{. 



Furthermore, e tsqk ^ k (k = 1,2,3) and e isp l k (k = 1,2,3) are single-mode universal 28] . 
Hence 



X ( Q 2 
R q {v) = F exp i ( aq + b— + c 



3 

is single-mode universal, where v = (a, b, c). Addition of CZ enables all multi-mode univer- 
sality. 



Let us explain how to compensate the byproduct error X(m). Note that 



R g (v)X(m) = Z(m)R q+m (v), 
= Z(m)R q (M m v), 



where 



M„ 



and its inverse is 



' 1 m m? » 
1 2m 
1 



^ 1 — m m 2 ^ 



M" 1 



1 




-2m 

1 i 



Therefore, if we want to implement R q (v), and if there is the byproduct X(m), we have only 
to implement R q (M^v). Furthermore, we can show 

CZ(X(m)®I) = (X(m)®Z(m))CZ, 
CZ(I®X{m)) = (Z{m)®X(m))CZ. 

Therefore, the byproducts can be sent forward through CZ gates. In short, Fig. [2] (a) is 
universal if the feed-forwarding is appropriately done. 



D<5 



m 



X(m)FD;iMJ> 



FIG. 1: (Color online.) The CV teleportation gate. 

The application of followed by the measurement of p is equivalent to the measurement 
of the observable (DfypD?. Therefore, to implement the gate e tsq in Fig. [H we measure 



e lsq pe lbq =p + s. 



5 



(a) 



l°>c 



10 >o 



|0>c 



l°>c 



Sq(«Pl)| -rP>-> 

. ■■ 

SqCP2)| -rP)-> 



Sq(q>'3)| -rp>-> 



SqKlH£)-> 




(b) 



l°> P -[S^T 



l Q >p-fS^2 



|0 > P -|Sq(- e 3) 



l°)p-SqW 



II 



Sg(°i)i -rp» 



1Mp)> 5 



Sg(5 4 )i -rp» 




Alice 



Bob 



Alice 



FIG. 2: (Color online.) (a): S q (4>) stands for F^R q {(p). This circuit is universal if {<t>'j} are 
appropriately chosen according to the previous measurement results, (b): The blind version of (a). 
Obviously, S^'s commute with CZ's, and therefore (b) is equivalent to (a). 

It can be measured easily with a homodyne detection. To implement the gate e tsq2 l 2 in 
Fig. [U we measure 

e~ lsq2/ 2 pe isq2/2 =p+sq. 

It can also be measured with a homodyne detection in a rotated quadrature basis. In 
principle, the gate e lsq3 ^ 3 can be implemented in Fig. [I] by measuring 

e -^ 3 /^i 3 ^ = p + S q 2 . 

Finally, let us notice that the zero- momentum state |0) p is not realistic, and normally 
\0) p is approximated by the finitely squeezed vacuum state 

1 



dp e an* \p) 



(Trfi 2 ) 1 / 4 

This finite squeezing causes errors in the CV cluster MBQC 



p- 



21 



221. 
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III. BLIND QUANTUM COMPUTATION 



Let us also briefly review the basic idea of the original blind quantum computation 

n nnn 

protocol of Ref. |3[. For details, see Refs. |3l. I5I-I10I]. Alice, the client, has a quantum device 
which emits randomly-rotated single qubit states and a classical computer. Bob, the server, 
has a full quantum power. Let us assume that Alice wants to perform the cluster MBQC on 
the A-qubit graph state \G) with measurement angles {<pj}^ =l . If Alice sends Bob 
and Bob creates \G), the delegated quantum computation is of course possible. However, 
obviously, in this case Bob can learn Alice's privacy. Hence they run the following protocol: 

1. Alice sends Bob N randomly- rotated single-qubit states {\+e 3 )}jLi, where 

|+ e }^i=(|0) + e^|l))=e-^/ 2 |+) 

and 

0;e{ T fc = 0,l,...,7) 
is a random angle which is hidden to Bob. 

2. Bob applies CZ gates among them. Since CZ commutes with e~ lZ9 ^ 2 , what Bob 
obtains is 

N 

((g)CZ e )((g)e^/ 2 )|+)^ 

e&E j=l 
N 

(g)e-^/ 2 )((g)CZ e )|+)^ 

j=l e£E 
N 



((g)e-^/ 2 )|G), 



where E is the set of edges of G, and the subscript j of Zj means the operator acts on 
jth qubit. 

3. For j = 1 to N in turn: 

(a) Alice sends Bob 

Sj = 6j + 4>'j + r j 7T , 

where is the modification of <pj which includes appropriate feedforwardings 
(byproduct corrections) and Tj G {0, 1} is a random binary. 



(b) Bob does the measurement in the {|±<5.)} basis, and returns the measurement 
result to Alice. 



It was shown in Ref. [3[ that this protocol is correct. Here, correct means that if Bob is 
honest Alice obtains the correct outcome. In fact, if Bob measures fcth qubit in the {|±5 fe )} 
basis, 

(±s k \(<S)e~^ /2 )\G) 

3=1 

N 

= (±\e iZ ^ 2 ((g)e- iZ ^/ 2 )\G) 

3=1 

(g) e -iZj0j/A (±\ e iZkSk l 2 e~ iZk ° k,2 \G) 
<g)e^ 2 )(±,, k \Zi>\G), 

3+k 

which means that Bob effectively does the {|±<^)} basis measurement with the error Z Tk . 
The error Z Tk just flips the bit of the measurement result, and therefore it can be compen- 
sated later. 

It was also shown that the protocol is blind Q . Here, blind intuitively means that what- 
ever Bob does, Bob cannot learn anything about Alice's input, output, and algorithm. Intu- 
itive proof of the blindness is as follows: What Bob obtains are quantum states {|+0j)}j=i 
and classical messages {Sj}jL v Hence Bob's state is 

<g)N 



h,—,<t>N ri,...,r N j=l 



which means that Bob cannot learn anything about {(f)j}jLx whichever POVM he does on 
his system. 

In order to guarantee Alice's privacy, the geometry of the graph G must be secret to 
Bob. There are three ways of doing it. First one is to use the brickwork state 3J. It is a 
certain two-dimensional graph state which is universal with only {|±g)} basis measurements 
for 9 G {^f\k = 0, 1, 7}. Second one is to implant a "hair" to each qubit of the regular 
lattice graph state [8J. For example, let us consider the left graph state of Fig. [3j We can 
simulate Z measurement and any X — Y plane measurement on any blue qubit with only 

8 



X — Y plane measurements on yellow and blue qubits. Hence we can "carve out" a specific 
graph state from the square lattice of blue qubits as is shown in the right of Fig. |3j Third 
one is so called "the graph hiding technique" By using this technique, Alice can have 
Bob prepare any graph state in such a way that Bob cannot learn the geometry of the graph. 
This technique is based on the simple idea that CZ does not create entanglement if one of 
the qubits is |0) or |1): 



CZ(M® |+» 
CZ(|V><8>|-)) 
CZ{\^)®\Q)) 
CZ(M®|1)) 



CZ(\i^)®\+)), 
{I ® Z)CZ(\i(>) 

\i>)® |o>, 



® I-}), 



Therefore, if Alice hides several qubits in |0) or |1) into the set of qubits she initially sends 
to Bob, she can let Bob create her desired graph state. Since Bob cannot distinguish |0), 
|1), and eight \+g) states, Bob cannot know when he entangles qubits (Fig. 0]). 




FIG. 3: (Color online.) The hair implantation technique Sj. Left: A two-qubit graph state ("hair") 
indicated by yellow is attached to each blue qubit of the square graph state. Right: A desired graph 
state can be carved out from the blue square graph. 





FIG. 4: (Color online.) The graph hiding technique j|. Yellow qubits are \+$), whereas red qubits 
are |0) or |1). Bob applies CZ gates on all edges of the left graph, but actually he obtains the right 
graph state, and he does not know its geometry. 
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IV. CV BLIND PROTOCOL 



Now let us consider the CV blind protocol. We here describe the ideal version and later 
consider realistic situations. Our protocol runs as follows: 



1. Alice sends Bob 



S 9 (-0;)|O> ? 



N 



where 9j = (aj, bj, Cj) is randomly chosen from M 3 and S q (v) = F^R q (v). 

2. Bob applies CZ gates. 

3. Alice and Bob might choose "the brickwork", "the hair implantation technique", or 
"the graph hiding technique" . Irrespective of their choice, we can assume without loss 
of generality that Bob has the "encrypted" CV graph state 



A? 



where \G) is the iV-qumode CV graph state, and the subscript j of means it acts 
on the jth qumode. 

4. For j = 1 to N in turn: 

(a) Let cj)j = (otj,(3j,jj) be Alice's computational parameters, and Let (j)', = 
(a'j, f3'j, tJ) be the one including feedforwardings. Alice sends Bob Sj = Mg. Wj 
where 

( a'j + a, - I/, + r , ^ 



W ; 



I 



% + bj 
V ^ + c i 

and Tj G 1 is a random real number. 

(b) Bob applies S q (5j) on jth qumode and does the p measurement on it. (Or he 
directly measures SU5j)pS q (5j) of the jth qumode.) He sends the measurement 
result to Alice. 
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V. CORRECTNESS 



Let us show the correctness of our protocol. See Fig. [2] (b), which is the circuit represen- 
tation of our protocol. Since S q commutes with CZ, Fig. [2] (b) is equivalent to Fig. [2] (a). 
Note that the equivalence between (a) and (b) in Fig. [2] is based on only the commutativity 
between S q and CZ, and therefore it holds even if we replace each input |0) p with its finitely 
squeezed version. Hence, the finite squeezing does not cause any additional effect here. 

More precisely, note that the following is true for any state 



p ( P \Sl(8 j )X>fc)Z>(Ti j )S>(-e j )\il;) 

p ( P \x^Qz^ V] )s^w,)s^-e,m 

p (p\exp ij 

2 3 

(«; + a 3 - Vj + rj )q + (# + fejOy + + c,-)j 

3 



7 Q q 

+r) j q-a j q-b j —-c j — 

r f q q 

= p {p\ exp[ir 3 -g] exp [ijajg + + 

= P (p|exp[zr^]^(^.)l^) 
Hence, Bob effectively does the correct MBQC except for the fact that if the measurement 



result is p, the byproduct which comes from this measurement is not X(p) but X(p 



' 3)1 



which can be compensated by changing the following measurement parameters. Since the 
above equation is true for any state the situation does not change even if the squeezing 
is finite. 

The brickwork implementation for the CV blind protocol is shown in Fig. [51 El and [71 
Since CZ ■ CZ ^ I for the CV case, we cannot directly generalize the qubit brickwork state 
of Ref. jsj. In particular, we need CZ and CZ^ as is shown in Figs. El El and[7J 

The hair implantation technique also works if we implant four-qumode hair on each 
qumode, since the measurement of q on a qumode in a CV graph state removes that 
qumode 22|, and a q measurement can be simulated only with S^pS q measurements by 
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using the following relations: 

F ■ Fe iq2/2 ■ Fe iq2/2 ■ F = e iq2/2 e ip2/2 , 
e- ip2 / 2 e- ig2 /V 92/2 e ip2/2 = q. 

The graph hiding technique for qubits can also be generalized to CV, since 

CZ(\i/j)®\s) p ) = (I®Z(s))CZ(\iP)®\0) p ), 

CZ{\i>)®\s) q ) = {Z{s)\ij>))®\s) q . (1) 

Therefore, Alice can have Bob create a graph state where Z(s) are applied on some qumodes 
in such a way that Bob cannot know the graph geometry. 

Finally, let us consider the effect of the finite squeezing. As we have seen, the Alice's 
prerotation technique itself is valid for any initial state (Fig. EJ, and therefore the finite 
squeezing does not cause any additional problem apart from the original one inherent to the 



non-blind CV MBQC 



21 



22]. If Alice and Bob choose the brickwork implementation or the 
hair implantation technique, again the finite squeezing does not cause any additional effect 
since the brickwork blind quantum computation and the hair implantation technique are 
nothing but a normal cluster MBQC with some redundant gates. (Of course, this redundancy 
accelerates the accumulation of errors, and therefore requires more fault-tolerance, but such a 



21 



22 



problem is not a specific problem to the blind CV MBQC 
needs enough fault-tolerance for the scalability 



25 



ven the non-blind one ultimately 



29].) Finally, regarding the graph 



hiding technique, once the graph state is created, it is nothing but a usual CV MBQC with 
errors. If the squeezing is finite, Eq. (JTJ becomes not exact but approximate one. This causes 
additional errors on the created graph state, but such errors are that even the non-blind CV 
MBQC can experience. 

VI. BLINDNESS 

What Bob obtains are quantum states {S q (— 9j)\0) p }^ =1 and classical messages {5j}^ =l . 
Note that 

"j = M iA - <:>'■ • /// - r ,( 

= kj — TjC, 
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- F 



F -A- 



F 


-AH 


> — 


F -A-J 


> — 



II 



S q (v)^ 



FIG. 5: (Color online.) The implementation of Sq(v)<g)I. Blue two-qubit gate is CZ. Red two-qubit 
gate is CZ^ . Green triangles are byproducts. 



- F -A- 



- F 



F -A- 



F -A- 



II 



S p (v) A- 



FIG. 6: (Color online.) The implementation of S p (v) ® /. The blue box means R- q (M m 1 v) 



- F 



-A- 



F -A-*- F -A- F -A—* 





-AH 


> — 


F -A-l 


> — 



II 



FIG. 7: (Color online.) The implementation of CX. The blue boxes are Fe tq2 l 2 up to byproduct 
corrections. The purple box is Fe~ tq2 l 2 up to byproduct corrections. 
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where e = (1,0,0). Hence, Bob's state is 

N N 

n^(8)^(-^)io) PP (°i 5 i(-^) 

3=1 3=1 
N N 

J] dr 3 ® S «(- k 3 + r 3 e )\°)pp(°\ S l(- k 3 + r 3 e ) 
3=1 3=1 

N N 

n dr i®^(-*i) e<pjff i°>«»< o i e "*" ,,,5 i(- fe i) 

3=1 3=1 

N N 

3=1 3=1 
1 i 

which means that Bob's state is independent of {4>j}f=i- 

Note that the blindness holds also in the finite squeezed case, since 

N N 

11 dr 3 s q (-9j)\o, ^) pp (o, njisK-Oj) 

3=1 3=1 

N N 

\{dr 3 (g) S q {-kj + rje)\0, ^> pp (0, + r,e) 

3=1 3=1 
N N 

II dr > ® ^(-%)e ir ^|0, ^> PP (0, %|e-^^t ( _ % ) 

3=1 3 = 1 

N N 

\{dr 3 (g) ^(-^e^T^IO^^II^e^SjC-fc,-) 
i=i i=i 

TV TV 



n^(8) T ^[^(-^) e ^ <? i o ) PP ( o i e ~ ,rj9 ^ t (-^ 

3=1 3=1 



Here, the operator 



commutes with S q . 



VII. DISCUSSION 



A. Implementation of e %q " I 3 

In optical systems, the implementation of e %qi I 3 is much harder than those of e tq and 
e iq2 / 2 . Hence it would be desirable for Alice to avoid the implementation of e 1 ^ I 3 by herself. 

14 



There are two solutions. One is that Bob embeds many e lsq ^ 3 |0) p with various s into his 
resource state. If Alice uses the hair implantation technique or the graph hiding technique, 
Bob cannot know which e zsq3 ^ 3 \0) p contributes to the computation. The other is to use the 
relation 

Q\t)e^f 3 Q{f) = e^' qi/ \ (2) 

where 

QU\ = g-»M*)(«P+pg)/2 

is the squeezing and t = (7 / /7) 1 ^ 3 - Since the squeezing can be done blindly, Alice can have 
Bob implement e ll ' qi ^ without allowing Bob to learn 7'. 

B. Blind CV protocol for measuring Alice 

If the state measurement is relatively easy, we can consider another blind quantum com- 



putation protocol, where Bob creates the resource state and Alice does the measurement 



io|. 



One advantage of this protocol is that the security is guaranteed by the no-signaling prin- 



ciple 30], which is more fundamental than quantum physics, and Alice does not need to 
verify her measurement device (the device independence 3Jj). The CV cluster MBQC is 



suitable for such a measuring Alice protocol, since the measurements of 



e - iaq pe taq = p + s, 

e -i Sq */2 pe is q y2 = p + sq 

are easily done with the homodyne detection. The gate e lsq3 ^ can be implemented blindly 
by using Eq. (J2]). 

C. Temporal encoding 



If we use the temporal degrees of freedom, only a single CZ machine is sufficient [32 ]. 
As is shown in Fig. [SJ it is easy to see that blind versions of such a temporal encoding 
implementation are possible both for the preparing Alice (Fig. [8] (a)) and the measuring 
Alice (Fig. 0(b)). 

15 



(a) 



Alice 



cc 



Bob 



cz 




(b) 

Bob Alice 




FIG. 8: (Color online.) Blind version of the temporal-encoding [32|]. S is the squeezed state source, 
D is the measurement device, CZ is the machine which implements the CZ gate, and CC is a 
classical computer. 
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Appendix A: Proof of Fig. [5] 



where P is a byproduct and 



CZ 



PF ■ PFS q {v) 




CZ\X{m)®I) = (X(m)® Z{-m))CZ\ 
CZ\l®X(m)) = {Z{-m)®X(m))CZ ] . 
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Appendix B: Proof of Fig. [6] 



PFSJM^v) ■ X( 
PF-PF 



FS„ q (v)F 
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Appendix C: Proof of Fig. [7] 



where 



CZ ] 

cz ] 
cz ] 
cz^ 
cz^ 



cz 



cz 



X g Fe-^ q - h+c+b ^/ 2 ■ X h F 
X f F ■ X e F 

X g e-^ p - h+c+b ^/ 2 FX h F 

X f Z e FF 
Xge -i(p-h+c+b)V2 ZhFF 

X f Z e FF 

X i {p -h+c+bf/2 Z \ 

g h \CZ 

x f z e J \ x„ b z^ q2 i 2 

X g e-^- h+c+ V 2 / 2 Z h X_ d Z_ c Z_ b 



CZ 



X d Fe i( - q - c ^ 2 / 2 ■ X C F 
X b F ■ X a Fe iq2 / 2 

FZ„ d X c e iq2 / 2 F 
FZ^ b FZ_ a e iq2 l 2 

FFX_ d Z_ c e ip2 / 2 
FFX„ b Z_ a e iq2 l 2 



X_ d Z_ c e 



ip 2 /2 



,ip 2 /2 



XfZ e Z_ d X_ b Z_ a 



X g ZhX_ d Z- c Z- b e 
XfZ e Z_ d X_ b Z. 



-ip 2 /2 



CZ 



cz 



Jp 2 /2 

Jq 2 /2 



D iq 2 /2 



CZi | 


( e -w 2 /2 \ 




( e i P 2 /2 \ 




\cz\ 






\ 1 ) 




, ^ 2 /2 J 



cx. 



-ip 2 /2 



I)e 



iq®q( ip 2 /2 



I) 



D i(q®q)-i(p®q) 



and we have used e A+B = e A e B e^ A ' B ^ 2 which is valid if [A, [A, B}} = [B, [A, B}} = 0. 
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